release-skill 0.1.1

package/src/core/approval.mjs

@@ -0,0 +1,332 @@
+/**
+ * Shared approval validation for publish and reconcile commands.
+ *
+ * Centralises the safety gates that an approval record must pass before
+ * any external write actions can proceed:
+ * - planDigest matches the computed plan digest
+ * - baseline.gitTreeHash matches the plan baseline
+ * - targetVersion matches the plan's first unit target version
+ * - approvedActions exactly equals plan external action ids (no superset, no subset)
+ * - approval has not expired
+ * - approval duration does not exceed 24 hours
+ * - approvedAt is not in the future (beyond 5-minute clock skew tolerance)
+ *
+ * @module core/approval
+ */
+
+import { ReleaseError, GATE_FAILED } from './errors.mjs';
+import { computePlanDigest } from './plan.mjs';
+import { sha256Hex } from './digest.mjs';
+import { readFile } from 'node:fs/promises';
+import { basename, dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import Ajv from 'ajv';
+import addFormats from 'ajv-formats';
+import { WORKSPACE_DIGEST_ALGORITHM } from './baseline.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const approvalSchema = JSON.parse(await readFile(
+  join(__dirname, '..', '..', 'schemas', 'approval-record.schema.json'),
+  'utf8',
+));
+const approvalAjv = new Ajv({ allErrors: true, strict: false });
+addFormats(approvalAjv);
+const validateApprovalSchema = approvalAjv.compile(approvalSchema);
+
+export function validateApprovalRecordSchema(approval) {
+  if (validateApprovalSchema(approval)) return;
+  const errors = validateApprovalSchema.errors ?? [];
+  throw new ReleaseError(
+    GATE_FAILED,
+    `approval record schema validation failed: ${errors.map((error) => `${error.instancePath || '/'}: ${error.message}`).join('; ')}`,
+    { validationErrors: errors },
+  );
+}
+
+export function computeApprovalDigest(rawApproval) {
+  return sha256Hex(typeof rawApproval === 'string' || Buffer.isBuffer(rawApproval)
+    ? rawApproval
+    : JSON.stringify(rawApproval, null, 2));
+}
+
+export function assertImmutableApprovalAuthority(approvalPath, plan, rawApproval) {
+  if (!plan?.production) return;
+  const planDigest = computePlanDigest(plan);
+  const approvalDigest = computeApprovalDigest(rawApproval);
+  const absolute = resolve(approvalPath);
+  const planDirectory = dirname(absolute);
+  if (
+    basename(absolute) !== `${approvalDigest}.json` ||
+    basename(planDirectory) !== planDigest ||
+    basename(dirname(planDirectory)) !== 'approvals'
+  ) {
+    throw new ReleaseError(
+      GATE_FAILED,
+      'production commands require approvals/<planDigest>/<approvalDigest>.json immutable authority',
+      { approvalPath, planDigest, approvalDigest },
+    );
+  }
+  return approvalDigest;
+}
+
+/**
+ * Validate an approval record against a loaded plan.
+ *
+ * @param {Object} plan        The parsed release plan (must already pass schema validation).
+ * @param {Object} approval    The parsed approval record.
+ * @param {Object} [options]
+ * @param {() => string} [options.clock]  Clock function returning ISO-8601 strings.
+ *
+ * @throws {ReleaseError} GATE_FAILED if any validation check fails.
+ */
+export function validateApproval(plan, approval, options = {}) {
+  const clockFn = typeof options.clock === 'function' ? options.clock : () => new Date().toISOString();
+
+  // --- Required fields ---
+  if (!approval || typeof approval !== 'object') {
+    throw new ReleaseError(
+      GATE_FAILED,
+      'approval record is missing or not an object',
+      {},
+    );
+  }
+
+  if (!approval.planDigest || !approval.baseline?.gitTreeHash || !approval.expiresAt) {
+    throw new ReleaseError(
+      GATE_FAILED,
+      'approval record missing required fields: planDigest, baseline.gitTreeHash, or expiresAt',
+      { approval },
+    );
+  }
+
+  if (plan.production?.mode === 'github-npm-v1') {
+    if (plan.baseline?.workspaceDigestAlgorithm !== WORKSPACE_DIGEST_ALGORITHM) {
+      throw new ReleaseError(
+        GATE_FAILED,
+        `production plan workspace digest algorithm is missing or obsolete; expected ${WORKSPACE_DIGEST_ALGORITHM}`,
+        { expected: WORKSPACE_DIGEST_ALGORITHM, actual: plan.baseline?.workspaceDigestAlgorithm ?? null },
+      );
+    }
+    if (approval.baseline?.workspaceDigestAlgorithm !== WORKSPACE_DIGEST_ALGORITHM) {
+      throw new ReleaseError(
+        GATE_FAILED,
+        `production approval workspace digest algorithm is missing or obsolete; expected ${WORKSPACE_DIGEST_ALGORITHM}`,
+        { expected: WORKSPACE_DIGEST_ALGORITHM, actual: approval.baseline?.workspaceDigestAlgorithm ?? null },
+      );
+    }
+  }
+  if (
+    plan.baseline?.workspaceDigestAlgorithm &&
+    approval.baseline?.workspaceDigestAlgorithm !== plan.baseline.workspaceDigestAlgorithm
+  ) {
+    throw new ReleaseError(
+      GATE_FAILED,
+      'approval workspace digest algorithm does not match the frozen plan',
+      {
+        planAlgorithm: plan.baseline.workspaceDigestAlgorithm,
+        approvalAlgorithm: approval.baseline?.workspaceDigestAlgorithm ?? null,
+      },
+    );
+  }
+
+  // --- planDigest match ---
+  const actualDigest = computePlanDigest(plan);
+  if (approval.planDigest !== actualDigest) {
+    throw new ReleaseError(
+      GATE_FAILED,
+      `approval planDigest mismatch: approval says ${String(approval.planDigest).slice(0, 16)}..., plan is ${actualDigest.slice(0, 16)}...`,
+      { approvalDigest: approval.planDigest, planDigest: actualDigest },
+    );
+  }
+
+  // --- baseline.gitTreeHash match ---
+  if (approval.baseline.gitTreeHash !== plan.baseline?.gitTreeHash) {
+    throw new ReleaseError(
+      GATE_FAILED,
+      `approval baseline mismatch: approval says ${approval.baseline.gitTreeHash}, plan says ${plan.baseline?.gitTreeHash}`,
+      { approvalTreeHash: approval.baseline.gitTreeHash, planTreeHash: plan.baseline?.gitTreeHash },
+    );
+  }
+
+  // --- baseline.workspaceDigest match ---
+  if (plan.baseline?.workspaceDigest) {
+    if (!approval.baseline?.workspaceDigest) {
+      throw new ReleaseError(
+        GATE_FAILED,
+        'approval record missing baseline.workspaceDigest (plan has workspaceDigest)',
+        { planWorkspaceDigest: plan.baseline.workspaceDigest },
+      );
+    }
+    if (approval.baseline.workspaceDigest !== plan.baseline.workspaceDigest) {
+      throw new ReleaseError(
+        GATE_FAILED,
+        `approval workspaceDigest mismatch: approval says ${approval.baseline.workspaceDigest}, plan says ${plan.baseline.workspaceDigest}`,
+        { approvalWorkspaceDigest: approval.baseline.workspaceDigest, planWorkspaceDigest: plan.baseline.workspaceDigest },
+      );
+    }
+  }
+
+  // --- Bind approval to every unit id + targetVersion pair ---
+  const units = plan.units ?? [];
+  const expectedUnitVersions = {};
+  const versions = new Set();
+  for (const unit of units) {
+    if (!unit.targetVersion || typeof unit.targetVersion !== 'string' || unit.targetVersion.trim() === '') {
+      throw new ReleaseError(
+        GATE_FAILED,
+        `unit "${unit.id ?? '(unknown)'}" is missing targetVersion; all units must have a non-empty targetVersion`,
+        { unitId: unit.id },
+      );
+    }
+    expectedUnitVersions[unit.id] = unit.targetVersion;
+    versions.add(unit.targetVersion);
+  }
+
+  if (approval.unitVersions) {
+    const expectedIds = Object.keys(expectedUnitVersions).sort();
+    const approvedIds = Object.keys(approval.unitVersions).sort();
+    if (JSON.stringify(expectedIds) !== JSON.stringify(approvedIds)) {
+      throw new ReleaseError(
+        GATE_FAILED,
+        'approval unitVersions keys do not exactly match plan units',
+        { expectedIds, approvedIds },
+      );
+    }
+    for (const unitId of expectedIds) {
+      if (approval.unitVersions[unitId] !== expectedUnitVersions[unitId]) {
+        throw new ReleaseError(
+          GATE_FAILED,
+          `target version mismatch for unit "${unitId}": plan says ${expectedUnitVersions[unitId]}, approval says ${approval.unitVersions[unitId]}`,
+          { unitId, planVersion: expectedUnitVersions[unitId], approvalVersion: approval.unitVersions[unitId] },
+        );
+      }
+    }
+    if (approval.targetVersion !== undefined) {
+      if (versions.size !== 1) {
+        throw new ReleaseError(
+          GATE_FAILED,
+          'approval targetVersion is ambiguous for heterogeneous unitVersions; omit targetVersion',
+          { targetVersion: approval.targetVersion, expectedUnitVersions },
+        );
+      }
+      const [planVersion] = versions;
+      if (approval.targetVersion !== planVersion) {
+        throw new ReleaseError(
+          GATE_FAILED,
+          `approval targetVersion conflicts with unitVersions: expected ${planVersion}, got ${approval.targetVersion}`,
+          { planVersion, approvalVersion: approval.targetVersion },
+        );
+      }
+    }
+  } else {
+    if (versions.size !== 1) {
+      throw new ReleaseError(
+        GATE_FAILED,
+        'heterogeneous multi-unit plan requires approval.unitVersions',
+        { expectedUnitVersions },
+      );
+    }
+    const planVersion = units[0]?.targetVersion;
+    if (!approval.targetVersion || planVersion !== approval.targetVersion) {
+      throw new ReleaseError(
+        GATE_FAILED,
+        `target version mismatch: plan says ${planVersion}, approval says ${approval.targetVersion ?? '(missing)'}`,
+        { planVersion, approvalVersion: approval.targetVersion },
+      );
+    }
+  }
+
+  // --- approvedActions exact set equality (not just superset) ---
+  const approvedSet = new Set(approval.approvedActions ?? []);
+  const planActionIds = new Set((plan.externalActions ?? []).map((a) => a.id));
+
+  // Every plan action must be in the approved set
+  for (const action of plan.externalActions ?? []) {
+    if (!approvedSet.has(action.id)) {
+      throw new ReleaseError(
+        GATE_FAILED,
+        `action "${action.id}" is not in the approved actions list`,
+        { actionId: action.id, approvedActions: [...approvedSet] },
+      );
+    }
+  }
+
+  // No extra actions in the approved set (exact match required)
+  for (const approvedId of approvedSet) {
+    if (!planActionIds.has(approvedId)) {
+      throw new ReleaseError(
+        GATE_FAILED,
+        `approved actions list contains "${approvedId}" which is not a plan action; exact set equality required`,
+        { approvedId, planActionIds: [...planActionIds] },
+      );
+    }
+  }
+
+  // --- Time validation ---
+  const approvedAtDate = new Date(approval.approvedAt);
+  if (Number.isNaN(approvedAtDate.getTime())) {
+    throw new ReleaseError(
+      GATE_FAILED,
+      `invalid approvedAt: "${approval.approvedAt}"`,
+      { approvedAt: approval.approvedAt },
+    );
+  }
+
+  const expiresAtDate = new Date(approval.expiresAt);
+  if (Number.isNaN(expiresAtDate.getTime())) {
+    throw new ReleaseError(
+      GATE_FAILED,
+      `invalid expiresAt: "${approval.expiresAt}"`,
+      { expiresAt: approval.expiresAt },
+    );
+  }
+
+  if (expiresAtDate.getTime() <= approvedAtDate.getTime()) {
+    throw new ReleaseError(
+      GATE_FAILED,
+      `expiresAt (${approval.expiresAt}) must be after approvedAt (${approval.approvedAt})`,
+      { approvedAt: approval.approvedAt, expiresAt: approval.expiresAt },
+    );
+  }
+
+  // --- Max 24h approval window ---
+  const MAX_APPROVAL_MS = 24 * 60 * 60 * 1000; // 24 hours
+  const approvalDurationMs = expiresAtDate.getTime() - approvedAtDate.getTime();
+  if (approvalDurationMs > MAX_APPROVAL_MS) {
+    throw new ReleaseError(
+      GATE_FAILED,
+      `approval duration ${Math.round(approvalDurationMs / 3600000)}h exceeds maximum 24h`,
+      { approvedAt: approval.approvedAt, expiresAt: approval.expiresAt, durationHours: approvalDurationMs / 3600000 },
+    );
+  }
+
+  // --- Reject future approvedAt (beyond 5-minute clock skew tolerance) ---
+  const CLOCK_SKEW_TOLERANCE_MS = 5 * 60 * 1000; // 5 minutes
+  const now = clockFn();
+  const nowDate = new Date(now);
+  if (Number.isNaN(nowDate.getTime())) {
+    throw new ReleaseError(
+      GATE_FAILED,
+      `invalid clock value: "${now}"`,
+      { clock: now },
+    );
+  }
+  if (approvedAtDate.getTime() > nowDate.getTime() + CLOCK_SKEW_TOLERANCE_MS) {
+    throw new ReleaseError(
+      GATE_FAILED,
+      `approvedAt (${approval.approvedAt}) is in the future (current time: ${now})`,
+      { approvedAt: approval.approvedAt, now },
+    );
+  }
+
+  // --- Expiry (publish/reconcile require current approval; verify may only
+  // revalidate the immutable approval identity after publication) ---
+  if (options.requireUnexpired !== false && nowDate > expiresAtDate) {
+    throw new ReleaseError(
+      GATE_FAILED,
+      `approval expired at ${approval.expiresAt}, current time is ${now}`,
+      { expiresAt: approval.expiresAt, now },
+    );
+  }
+
+}

package/src/core/baseline.mjs

@@ -0,0 +1,272 @@
+import { execFile as execFileCb } from 'node:child_process';
+import { promisify } from 'node:util';
+import { createHash } from 'node:crypto';
+import { lstat, open, readlink } from 'node:fs/promises';
+import { constants as fsConstants } from 'node:fs';
+import path from 'node:path';
+
+const execFile = promisify(execFileCb);
+
+/**
+ * Narrow, centrally-defined list of release-skill control-plane paths that
+ * the tool itself creates or deletes during the release lifecycle. These
+ * paths must be excluded from workspaceDigest and statusEntries so that the
+ * prepare→approve→publish happy path does not trigger a false BASELINE_CHANGED.
+ *
+ * Only paths **within** `.release-skill/` are listed here. Runtime directories
+ * use reserved prefixes; immutable plans and approvals use exact digest-shaped
+ * paths so arbitrary files under similarly named directories remain visible.
+ *
+ * `project.yaml` is intentionally **not** listed — changes to project
+ * configuration must always cause a baseline drift.
+ */
+export const WORKSPACE_DIGEST_ALGORITHM = 'git-workspace-v2';
+
+const CONTROL_PLANE_PREFIXES = [
+  '.release-skill/lock',
+  '.release-skill/lock-audit',
+  '.release-skill/runs',
+  '.release-skill/transactions',
+];
+const RESERVED_CONTROL_PREFIXES = [
+  ...CONTROL_PLANE_PREFIXES,
+  '.release-skill/plans',
+  '.release-skill/approvals',
+];
+const CONTROL_PLANE_EXACT = new Set([
+  '.release-skill/release-plan.json',
+  '.release-skill/approval-record.json',
+]);
+const DIGEST = '[a-f0-9]{64}';
+const IMMUTABLE_PLAN = new RegExp(`^\\.release-skill/plans/${DIGEST}\\.json$`);
+const IMMUTABLE_APPROVAL = new RegExp(
+  `^\\.release-skill/approvals/${DIGEST}/${DIGEST}\\.json$`,
+);
+
+/**
+ * Check whether a path (relative to repo root, using `/` separators) is a
+ * release-skill control-plane file that should be excluded from the digest.
+ *
+ * @param {string} p - Repo-relative path.
+ * @returns {boolean}
+ */
+function isControlPlanePath(p) {
+  // Git's -z output preserves path bytes and uses `/` as the repository
+  // separator. Do not rewrite literal backslashes: on POSIX they are valid
+  // filename bytes, not separators.
+  const normalized = p;
+  if (CONTROL_PLANE_EXACT.has(normalized)) return true;
+  if (IMMUTABLE_PLAN.test(normalized) || IMMUTABLE_APPROVAL.test(normalized)) return true;
+  return CONTROL_PLANE_PREFIXES.some(
+    (cp) => normalized === cp || normalized.startsWith(`${cp}/`),
+  );
+}
+
+export function isReservedReleaseControlPath(p) {
+  return RESERVED_CONTROL_PREFIXES.some(
+    (prefix) => p === prefix || p.startsWith(`${prefix}/`),
+  ) || CONTROL_PLANE_EXACT.has(p);
+}
+
+function splitNul(value) {
+  const records = value.split('\0');
+  if (records.at(-1) === '') records.pop();
+  return records;
+}
+
+function parseStatusPorcelainZ(statusOut) {
+  const records = splitNul(statusOut);
+  const entries = [];
+  for (let index = 0; index < records.length; index += 1) {
+    const record = records[index];
+    if (record.length < 3) throw new Error('Malformed git status --porcelain=v1 -z record');
+    const xy = record.slice(0, 2);
+    const destination = record.slice(3);
+    const renamed = xy.includes('R') || xy.includes('C');
+    const source = renamed ? records[++index] : null;
+    if (renamed && source === undefined) {
+      throw new Error('Malformed git status rename record: missing source path');
+    }
+    const paths = source === null ? [destination] : [source, destination];
+    // A rename crossing the control-plane boundary is user-visible. Exclude
+    // only when every path participating in the status record is control data.
+    if (paths.every(isControlPlanePath)) continue;
+    entries.push(source === null
+      ? `${xy} ${destination}`
+      : `${xy} ${source} -> ${destination}`);
+  }
+  return entries;
+}
+
+/**
+ * Compute a deterministic workspace digest covering staged, unstaged, and
+ * untracked (non-ignored) content.
+ *
+ * Sources:
+ * - `git ls-files -s` -- staged index entries (mode, object hash, path)
+ * - `git diff` -- unstaged modifications to tracked files (patch text)
+ * - `git ls-files -o --exclude-standard` -- untracked files respecting .gitignore
+ *
+ * All lines are sorted lexicographically to ensure determinism. The combined
+ * string is hashed with SHA-256.
+ *
+ * Control-plane paths (lock, runs, approval-record, etc.) are filtered out
+ * so that release-skill's own lifecycle files do not cause baseline drift.
+ *
+ * @param {string} root - Absolute path to a valid git repository directory.
+ * @returns {Promise<string>} Hex-encoded SHA-256 digest.
+ */
+async function computeWorkspaceDigest(root) {
+  const opts = { cwd: root, shell: false, encoding: 'utf8' };
+
+  const [
+    { stdout: stagedOut },
+    { stdout: changedOut },
+    { stdout: untrackedOut },
+  ] = await Promise.all([
+    execFile('git', ['ls-files', '-s', '-z'], opts),
+    execFile('git', ['diff', '--name-only', '-z'], opts),
+    execFile('git', ['ls-files', '-o', '--exclude-standard', '-z'], opts),
+  ]);
+
+  // Collect all meaningful lines
+  const parts = [];
+
+  // Staged entries: one line per file like "100644 <hash> 0\tpath"
+  // Filter out control-plane paths.
+  for (const record of splitNul(stagedOut)) {
+    const tabIdx = record.indexOf('\t');
+    const filePath = tabIdx >= 0 ? record.slice(tabIdx + 1) : null;
+    if (filePath && isControlPlanePath(filePath)) continue;
+    parts.push(record);
+  }
+
+  // Ask Git for unambiguous NUL-delimited names, then request the patch for
+  // each exact argv path. This avoids parsing C-quoted `diff --git` headers.
+  const changedPaths = splitNul(changedOut).filter((p) => !isControlPlanePath(p));
+  for (const changedPath of changedPaths) {
+    const { stdout: patch } = await execFile(
+      'git',
+      ['diff', '--no-ext-diff', '--no-textconv', '--binary', '--no-color', '--', changedPath],
+      opts,
+    );
+    parts.push(`UNSTAGED:${changedPath}\0${patch}`);
+  }
+
+  // Untracked (non-ignored) entries: filter control-plane paths, then produce a
+  // safe content digest binding path + Git-visible type + file bytes.
+  const untrackedPaths = splitNul(untrackedOut)
+    .filter((p) => p.length > 0 && !isControlPlanePath(p));
+
+  const untrackedParts = await Promise.all(
+    untrackedPaths.map(async (relPath) => {
+      const absPath = path.resolve(root, relPath);
+
+      // Defense-in-depth: resolved path must remain within the repo root.
+      // Normalise both sides to handle trailing-separator differences.
+      const normalisedRoot = path.resolve(root) + path.sep;
+      if (!absPath.startsWith(normalisedRoot) && absPath !== path.resolve(root)) {
+        throw new Error(
+          `Refusing to read path outside repository root: ${relPath} resolves to ${absPath}`,
+        );
+      }
+
+      const stat = await lstat(absPath);
+      // Git-visible type marker (do NOT follow symlinks)
+      let type;
+      if (stat.isSymbolicLink()) {
+        type = 'symlink';
+      } else if (stat.isDirectory()) {
+        type = 'dir';
+      } else if (stat.isFile()) {
+        type = 'file';
+      } else {
+        type = 'other';
+      }
+      const typeMarker = `TYPE:${type}`;
+
+      let content;
+      if (stat.isFile()) {
+        // TOCTOU-safe read: open with O_NOFOLLOW so a symlink replacing the
+        // file between lstat and open causes ELOOP, then verify the inode
+        // still matches to catch same-type replacement races.
+        const handle = await open(absPath, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
+        try {
+          const fdStat = await handle.stat();
+          if (fdStat.ino !== stat.ino) {
+            throw new Error(
+              `Race detected: inode changed for ${relPath} between lstat and read`,
+            );
+          }
+          const { buffer, bytesRead } = await handle.read(
+            Buffer.alloc(fdStat.size || 4096),
+            0,
+            fdStat.size || 4096,
+            0,
+          );
+          content = buffer.subarray(0, bytesRead);
+        } finally {
+          await handle.close();
+        }
+      } else if (stat.isSymbolicLink()) {
+        // Bind the link target itself — do NOT follow.
+        content = Buffer.from(await readlink(absPath), 'utf8');
+      } else {
+        content = Buffer.alloc(0);
+      }
+
+      return [
+        relPath,
+        typeMarker,
+        createHash('sha256').update(content).digest('hex'),
+      ].join('\t');
+    }),
+  );
+
+  // Sort for determinism
+  parts.sort();
+  untrackedParts.sort();
+
+  const combined = parts.join('\n')
+    + (parts.length && untrackedParts.length ? '\n' : '')
+    + untrackedParts.join('\n');
+
+  return createHash('sha256').update(combined).digest('hex');
+}
+
+/**
+ * Capture the Git baseline state for a repository.
+ *
+ * Returns a `workspaceDigest` that deterministically covers HEAD/tree AND
+ * staged, unstaged, and untracked (non-ignored) content. Changes to
+ * git-ignored paths (e.g. `.release-skill/`, `node_modules/`) do not affect
+ * the digest.
+ *
+ * @param {string} root - Absolute path to a valid git repository directory.
+ * @returns {Promise<{ gitHead: string, gitTreeHash: string, workspaceDigest: string, statusEntries: string[], capturedAt: string }>}
+ */
+export async function captureBaseline(root) {
+  const opts = { cwd: root, shell: false, encoding: 'utf8' };
+
+  const [{ stdout: headOut }, { stdout: treeOut }, { stdout: statusOut }] =
+    await Promise.all([
+      execFile('git', ['rev-parse', 'HEAD'], opts),
+      execFile('git', ['rev-parse', 'HEAD^{tree}'], opts),
+      execFile('git', ['status', '--porcelain=v1', '-z', '--untracked-files=all'], opts),
+    ]);
+
+  const gitHead = headOut.trim();
+  const gitTreeHash = treeOut.trim();
+  const statusEntries = parseStatusPorcelainZ(statusOut);
+
+  const workspaceDigest = await computeWorkspaceDigest(root);
+
+  return {
+    gitHead,
+    gitTreeHash,
+    workspaceDigestAlgorithm: WORKSPACE_DIGEST_ALGORITHM,
+    workspaceDigest,
+    statusEntries,
+    capturedAt: new Date().toISOString(),
+  };
+}